How to enable Secure Boot on Windows 11

• To enable Secure Boot in Windows 11, restart your computer and enter the UEFI settings.
• Then navigate to the Boot or Security tab, locate the “Secure Boot” option, and set it to “Enabled.”
• Save changes and exit the UEFI settings. Upon reboot, Secure Boot will be active.

UPDATED 11/4/2025: On Windows 11, you can enable Secure Boot to enhance the security of your computer’s boot process. In this guide, I’ll explain the steps to complete this configuration.

Although Microsoft recommends enabling Secure Boot on Windows 11, it’s not required to run the operating system. As a result, the feature may be enabled or disabled on your computer.

What’s Secure Boot?

Secure Boot is a security feature available in the Unified Extensible Firmware Interface (UEFI) firmware that prevents unauthorized modifications to critical system files during startup. As a result, it ensures that a device boots using only software trusted by the manufacturer.

It establishes a “root of trust” during the computer startup process. It accomplishes this by checking the digital signature of the bootloader, operating system, and UEFI drivers before they are allowed to run on the device.

In short, Secure Boot helps protect against low-level malware, such as bootkits and rootkits, that can infect the boot process and gain control of your system before Windows 11 and your antivirus software even load.

Related

How to enable Secure Boot to play Battlefield 6 on Windows 11 (or 10)

In rare cases, enabling Secure Boot might interfere with older hardware or non-Windows operating systems. You might need to disable it temporarily in such scenarios. However, for optimal security with Windows 11, it’s generally recommended to keep it enabled.

In this guide, I will show you how to check and enable (or disable) Secure Boot on Windows 11.

• Check Secure Boot on Windows 11
• Enable Secure Boot on Windows 11
• Disable Secure Boot on Windows 11
• FAQs about enabling Secure Boot

Check Secure Boot on Windows 11

To determine whether Secure Boot is enabled on the computer, follow these steps:

1. Open Start.

2. Search for System Information and click the top result to open the app.

3. Click on System Summary on the left pane.

4. Check the “Secure Boot State” information and confirm the feature is turned “On.” (If not, you need to enable the option manually.)

   

Once you complete the steps, you can continue with the Windows 11 installation if the security feature is enabled. Otherwise, you must follow the steps below to enable it inside the UEFI firmware.

Enable Secure Boot on Windows 11

To enable Secure Boot in the BIOS firmware, follow these steps:

1. Open Settings.

2. Click on System.

3. Click the Recovery page.

4. Click the Restart now button under the “Advanced startup” section.

   

5. Click the Restart now button one more time.

6. Click on Troubleshoot.

7. Click on Advanced options.

8. Click the “UEFI Firmware settings” option.

   

9. Click the Restart button.

10. Open the advanced, security, or boot settings page, depending on the motherboard.

11. Select the “Secure Boot” option, then choose the “Enabled” option.

Once you complete the steps, Secure Boot will be enabled on the computer.

Disable Secure Boot on Windows 11

To disable Secure Boot on Windows 11, follow these steps:

1. Open Settings.

2. Click on System.

3. Click the Recovery page.

4. Click the Restart now button under the “Advanced startup” section.

   

5. Click on Troubleshoot.

6. Click on Advanced options.

7. Click the “UEFI Firmware settings” option.

   

8. Click the Restart button.

9. Open the advanced, security, or boot settings page, depending on the motherboard.

10. Select the “Secure Boot” option and choose the Disabled option.

After you complete the steps, Secure Boot will be disabled on the device.

FAQs about enabling Secure Boot

Here’s a list of frequently asked questions (FAQs) and answers about managing Secure Boot on Windows 11.

What is Secure Boot on Windows 11?

Secure Boot is a UEFI firmware feature that protects the startup process by ensuring only trusted, digitally signed software can load before Windows starts. It prevents rootkits, bootkits, and other low-level malware from hijacking your device before the antivirus system activates.

Is Secure Boot required for Windows 11?

No. While Microsoft recommends keeping Secure Boot enabled for enhanced protection, it’s not mandatory to run Windows 11. Some systems may have the feature disabled, and you can enable it manually in the UEFI settings if supported.

How do I enable Secure Boot on Windows 11?

To enable Secure Boot, restart your computer by navigating to Settings > System > Recovery, and then clicking “Restart now” under Advanced startup. After the restart, select Troubleshoot > Advanced options > UEFI Firmware Settings, and click Restart again to enter the BIOS interface.

Once in the firmware, open the Boot or Security tab, find the Secure Boot option, set it to “Enabled,” and then Save and Exit.

Why can’t I enable Secure Boot on my computer?

If the Secure Boot option is unavailable or greyed out, your system might be configured in Legacy BIOS mode or have CSM (Compatibility Support Module) enabled.

How do I check if Secure Boot is already enabled?

To check the status of Secure Boot on your system, open System Information by typing msinfo32 into the search bar, and then examine the Secure Boot State line. If it says “On,” Secure Boot is active. If it says “Off,” you must manually enable it in your system’s UEFI firmware settings.

What happens if I enable Secure Boot on Windows 11?

Windows 11 will start using Secure Boot verification on every boot, ensuring that only trusted firmware and drivers load. You won’t notice performance differences, but your computer will be better protected against low-level malware and tampering.

Can enabling Secure Boot cause problems with older hardware or dual-boot setups?

In rare cases, yes. Secure Boot can block unsigned bootloaders or older Linux distributions. You can temporarily disable it if necessary, but it’s recommended to re-enable Secure Boot once you finish troubleshooting or installing the secondary operating system.

What’s the difference between “Standard” and “Custom” Secure Boot mode?

Standard mode is recommended for most users, as it automatically loads the digital keys approved by the computer manufacturer, whereas Custom mode is intended for advanced users, developers, or systems using custom bootloaders, as it allows manual management and control of security keys.

Can I enable Secure Boot after installing Windows 11?

Yes. If the installation was performed using UEFI and your disk uses GPT, you can enable Secure Boot at any time in the UEFI firmware without reinstalling Windows.

Why is Secure Boot important for Windows 11 security?

Secure Boot serves as the foundation of Windows 11’s security model, complementing features such as Trusted Boot, BitLocker, and TPM. It ensures the operating system loads only from trusted sources, protecting the system before Windows and Defender even start.

Update November 4, 2025: This guide has been updated to ensure accuracy and reflect changes to the process.